This information is required for them to evaluate your risk and give you a price for insurance which is their core business. As a result, as I understand it, under GDPR you can refuse but they can also refuse to give you insurance as a result.